Integrate / API
Search all 116 operations, inspect parameters and schemas, and copy generated request examples from the canonical OpenAPI 3.0 contract.
Authentication boundaries
ComplicatedAuth separates control-plane browser sessions from the credentials used by a customer backend.
Management login uses a five-minute attempt plus one-time in-memory client secret. Only WebAuthn completion issues complicatedauth_session, an HTTP-only bootstrap or strong cookie. State-changing requests carry the exact Origin.
Send a scoped Project service credential as Authorization: Bearer <credential>. Keep it on the customer backend; never expose it to browser code.
Continue a login or session ceremony with X-ComplicatedAuth-Login or X-ComplicatedAuth-Session, always from the customer BFF to the API.
Contract conventions
These rules come from shared parameters and schemas in the canonical contract.
Use /api through the same-origin console proxy or http://localhost:8080 for direct local development. A production base URL is not published yet.
Collection endpoints accept an opaque cursor and a limit from 1–100. The default page size is 25.
JSON errors include code, message, and request_id, with optional structured details.
Resource identifiers use UUID strings. Timestamps use the OpenAPI date-time format.